Glossary
Risk register
A risk register is a provider’s record of the things that could go wrong, each scored by likelihood and consequence, with the controls in place, the treatment planned and who owns it, reviewed on a cycle.
What it is for
An incident register is reactive: it records what happened. A risk register is proactive: it records what could happen and what is being done about it. Regulators expect to see both, and to see that incidents feed back into the risks and the controls.
Categories, thresholds and timeframes are set by the regulator and change; confirm the current requirements with the regulator for your sector before acting on a real case.
More than a list
A register that was written once and never revisited is a list. The record that holds up shows each risk with its score, its controls, its owner, the treatment and its status, and the date it was last reviewed. A risk that moved from open to monitoring to closed, with the reasons, is evidence of a system working.
Sources and references
This entry describes the term in general. The regulator’s own site is the authority for your service, and requirements change.
Keep the record
The terms are the easy part. The evidence is the work.
Accorda keeps policies, sign-offs, training, incidents and registers audit-ready in one place. Try it free for 14 days, no credit card.